Analysis
-
max time kernel
92s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
11/04/2024, 08:36
General
-
Target
2024-04-11_4811e70e28012671417f8f4d600501e2_ryuk.exe
-
Size
1.5MB
-
MD5
4811e70e28012671417f8f4d600501e2
-
SHA1
753599d36a394af2b9cb2dc8758255c23ffd29c1
-
SHA256
a608073554ba168d9fc3b7925c46600ac80115e4023b0223c0c13ab25bd7f388
-
SHA512
50db301bc0be7bfdd02b3a3d9e486a604441c9e5958ad216dde20b0c1f8d7464b446b06de3762a84731d291ae46d75c2f6c1cc129f81db1a12a24e772c31f7b2
-
SSDEEP
24576:hgIRzVakfCrljcipXBg/RCjeHuF/Z3P5bqVJa:hnRzVakfCrl9s/RCjgWZ3NqVJ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-11_4811e70e28012671417f8f4d600501e2_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-11_4811e70e28012671417f8f4d600501e2_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD54260c2bfeeb8a72a41066e6d22b4e428
SHA1eeff955a5c373a9cb0161615b76b7a7c4eb50d00
SHA2567939bb84bcc77d4c50f5208ab588ee1b2363529a3174a169eab8709132eb80c4
SHA5125eec4332248af879c3666559e7a5c5f397ebef4852bcfb5ca6dcec335dc22875cb70e6ddc810bb9db095971e81e4b75a1a78ba5d15b356b644e45015e25d56de
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB